Law / United States / 
Indiana
Public entity technology resources and cybersecurity policies, assessments and connection requirements
Ind. Code secs. 4-13.1-4-2, 4-13.1-4-5, 4-13.1-4-6 and 4-13.1-4-8(a)
In force.
A sector security regimes rule binding government bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a public entity: a political subdivision, state agency, school corporation, or state educational institution, other than an acute care hospital established and operated under IC 16-22-2, IC 16-22-8 or IC 16-23, or a department of public utilities established under IC 8-1-11.1.
- Not later than , adopt a policy governing use of technology resources by your employees, a cybersecurity policy (based on the Office of Technology's standards and guidelines for a political subdivision or state educational institution, or its uniform policy for a state agency or school corporation), and a training program on both that is mandatory for your employees.
- Not later than December 31 of each odd-numbered year, submit your cybersecurity policy to the Office of Technology, and give it the results of any assessment of the policy by a third party.
- If you connect to the technology infrastructure of the state after , have completed a cybersecurity assessment within the preceding three years, repeat one at least every three years, provide proof on request, and have a secondary end user authentication mechanism (and, if a state agency or political subdivision, an in.gov or .gov domain name).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Office of Technology may, at its discretion, disconnect a public entity that is not in compliance with the connection requirements from the technology infrastructure of the state.
What this law does
A public entity means a political subdivision, state agency, school corporation, or state educational institution. Not later than , each public entity must adopt a policy governing use of technology resources by its employees, a cybersecurity policy, and a training program that is mandatory for its employees. Not later than December 31 of each odd-numbered year, a public entity must submit its cybersecurity policy to the Office of Technology.
A public entity that engages a third party to assess its cybersecurity policy must provide the results of the assessment to the Office of Technology. A public entity that connects to the technology infrastructure of the state after must have completed a cybersecurity assessment within the three year period before the connection.